Fess is based on [OpenSearch](https://github.com/opensearch-project/OpenSearch), but knowledge/experience about OpenSearch is _not_ required. Fess provides an easy to use Administration GUI to configure the system via your browser.

And be compatible with all of them at the same time.

///

Create a utility function to hash a password coming from the user.

And another utility to verify if a received password matches the hash stored.

And another one to authenticate and return a user.

```

### 2. Create a sample OPA Policy

In another terminal, create a policy that allows root user all access and for all other users denies `PutObject`:

```sh
cat > example.rego <<EOF
package httpapi.authz

import input

default allow = false

# Allow the root user to perform any action.
allow {
 input.owner == true
}

# All other users may do anything other than call PutObject
allow {

    return delegate.isEmpty();
  }

  @Override
  public Object[] toArray() {
    return delegate.toArray();
  }

  @Override
  public <T extends @Nullable Object> T[] toArray(T[] other) {
    return delegate.toArray(other);
  }

  @Override
  public String toString() {
    return delegate.toString();
  }

  // TODO(cpovirk): equals(), as well, in case it's any faster than Sets.equalsImpl?

  @Override

 * </pre>
 *
 * <p>This tests {@code foo.equals(foo)}, {@code foo.equals(null)}, and a few other operations.
 *
 * <p>For more extensive testing, add multiple equality groups. Each group should contain objects
 * that are equal to each other but unequal to the objects in any other group. For example:
 *
 * <pre>
 * new EqualsTester()
 *     .addEqualityGroup(new User("page"), new User("page"))

```Python hl_lines="3  6-8"
{!../../docs_src/sub_applications/tutorial001.py!}
```

### Sub-application

Then, create your sub-application, and its *path operations*.

This sub-application is just another standard FastAPI application, but this is the one that will be "mounted":

```Python hl_lines="11  14-16"
{!../../docs_src/sub_applications/tutorial001.py!}
```

### Mount the sub-application

```Python hl_lines="81-83"
{!> ../../docs_src/websockets/tutorial003.py!}
```

////

To try it out:

* Open the app with several browser tabs.
* Write messages from them.
* Then close one of the tabs.

That will raise the `WebSocketDisconnect` exception, and all the other clients will receive a message like:

```
Client #1596980209979 left the chat
```

/// tip

* Previous steps before starting

## HTTPS

If we focus just on the **container image** for a FastAPI application (and later the running **container**), HTTPS normally would be handled **externally** by another tool.

It could be another container, for example with <a href="https://traefik.io/" class="external-link" target="_blank">Traefik</a>, handling **HTTPS** and **automatic** acquisition of **certificates**.

/// tip

      /*
       * If another handleException() caller created the set, we need to use that copy in case yet
       * other callers have added to it.
       *
       * This read is guaranteed to get us the right value because we only set this once (here).
       *
       * requireNonNull is safe because either our compareAndSet succeeded or it failed because
       * another thread did it for us.
       */

///

## Other middlewares

You can later read more about other middlewares in the [Advanced User Guide: Advanced Middleware](../advanced/middleware.md){.internal-link target=_blank}.